How can I validate the Firewalla Blue activity network flow apps summary?

I have been trying to monitor the activity of one of my children who spends too much time on the internet (iPhone8 or PC). I noticed that the total minutes spent in various categories (like YouTube and Netflix) on the iPhone is higher than the total allowed screen time programmed for the phone (4 hours), sometimes by more than a few hours.

I tried comparing the app start times and totals to the history events, and noticed that app times are almost always in full minutes, while history events are not - is 1 min 2 sec in history rounded up to 2 min in apps? Sometimes there are 2 identical entries (e.g. for YouTube) that start at the same time. We don't have apps for split screen viewing , so I'm not sure how two YouTube videos can be running simultaneously on his iPhone. I checked other devices (mine included) and the times for the categories don't seem right (I really haven't done 5 hours of audio/video today...I was at work all day!)

Is there a quick answer for this? I understand the app values aren't meant to be exact, but in my case they seem to be close to doubled. Currently I am not able to "trust" the time summaries indicated in the apps tab in network flows which limits its usefulness for my situation (and actually caused some tension until I figured out the numbers inflation). I'm hoping I don't have to try to download and sort through IP addresses...I think I'd rather unplug Firewalla before doing that!

I'd appreciate any help from a more experienced Firewalla user.

Firewalla

August 14, 2020 23:13

The quick answer is, the algorithm predicting user behavior is not accurate. We are trying to refine it as much as we can.

Predicting user behavior at the network level is like listening to people's steps behind a wall, and try to predict if they are running, dancing, or not doing anything, and in the background, there are other people walk around.

BECKY TU-SEKINE

August 14, 2020 23:57

Perhaps I don’t understand network flows well enough. I thought the download and upload events were just summed up and categorized in the apps tab. If this is the case, why is the categorized time under the apps tab so much higher than the actual connected time?
If this is not the case, what does the apps tab information represent?

August 15, 2020 02:47

This is because the detecting application activity is very difficult from listening to network traffic. The app tap is our algorithm trying (very hard) to summarize ... but, it is not accurate, hopefully we will enhance. it gradually

How can I validate the Firewalla Blue activity network flow apps summary?

Comments

Didn't find what you were looking for?